What is a policy attestation?
A policy attestation is a short statement by a staff member: “I have read and accept this policy.” It is recorded with the policy name and version, the person, the date and how they confirmed it.
Attestations matter because donors and auditors often ask a simple question: “How do you know your staff have read the code of conduct?” A policy on a shelf is not an answer. A dated record of each person’s acceptance is.
Which policies need one?
Do not ask for signatures on everything. When there are too many, people click without reading. Choose the policies that carry the most risk or that donors require. A typical list:
- Code of conduct.
- Safeguarding and protection from sexual exploitation and abuse (PSEA).
- Conflict of interest.
- Data protection and acceptable use of devices.
- Anti-fraud and anti-bribery.
- Whistleblowing and how to raise concerns.
Add health and safety or security rules for staff in risky settings.
How do you collect them?
- Publish a clean version. Give the policy a version number and an effective date. If you change it, the version number changes.
- Name who must attest. All staff, or a group such as managers or field staff. Decide whether volunteers, consultants and casual workers are included.
- Set a due date. Two to four weeks is typical. Say when it is due in the first message.
- Make it easy. One link, a plain-language summary, and a copy in the languages staff use. Offer a short briefing for those who find reading hard.
- Track the responses. Keep a list of who is due, who has responded and who is overdue.
- Follow up. Send a reminder halfway, then one at the due date, then speak to the last few in person.
- Report. Tell the leadership how many have responded, and who has not.
What should the record show?
For each attestation, keep:
| Field | Why it matters |
|---|---|
| Policy name and version | Shows what the person accepted |
| Person’s name | Shows who accepted |
| Date and time | Shows when |
| Method | Signed form, email reply or system record |
| Next renewal date | Shows when it expires |
A record with all five fields can be shown to an auditor in a minute.
When should you renew?
Renew in two cases: when the policy changes in a way that matters, and on a set cycle. Once a year is common for conduct and safeguarding. New staff should attest during onboarding, before they begin work with communities. Review the list of outstanding attestations every month, and read it before donor visits.
What does an attestation not prove?
It is worth being honest about the limit. A signature shows that a person accepted the policy. It does not show they understood it, or that they will follow it. Pair attestations with short training, examples in plain words and a safe way to ask questions. Our guides to safeguarding and PSEA basics and HR compliance basics cover the wider picture.
A few habits make attestations meaningful:
- Keep each policy short and written in plain words. A twenty-page policy that no one reads is a weak basis for a signature.
- Hold a ten-minute briefing for each new or changed policy, and let people ask questions.
- Give staff who work in other languages a translated summary, and note this in the record.
- Ask managers to raise the policy in team meetings, with one real example of how it applies.
- Include consultants, interns and casual workers who work with communities or hold sensitive data, not only employees.
Who checks that the process works?
Once a year, pick five staff at random and check that each has a current attestation for each required policy. Look for gaps: a new hire who skipped onboarding, a transferred staff member missed in the list, an old version still in use. Record what you find and what you fix. A donor or auditor who sees this check is more likely to trust the rest of your records.
Where EMPOBase fits
In Compliance, authorized users publish policy versions and monitor staff acknowledgements. Attestation records include the policy version, staff identity, timestamp and method. Signed PSEA and code of conduct declarations are renewable records with an expiry, and a banner appears at sign-in when one is due. EMPOBase records that the action happened. It does not establish understanding or legal compliance, so keep your briefings and training too. See the documentation for details.